ESET Security Mispadu Facebook Ads 2019

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.

Mispadu also uses encoded configuration files and has encoded payloads using Base64.

Mispadu can sends the collected financial data to the C2 server.

Mispadu can log keystrokes on the victim's machine.

Mispadu can enumerate the running processes on a compromised host.

Mispadu’s dropper uses VBS files to install payloads and perform execution.

Mispadu collects the OS version, computer name, and language ID.

Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.

Mispadu has the ability to capture screenshots on compromised hosts.

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.

Mispadu decrypts its encrypted configuration files prior to execution.

Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

Mispadu has been installed via MSI installer.

Mispadu uses RunDLL32 for execution via its injector DLL.

Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”

Mispadu can list installed security products in the victim’s environment.

Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

Mispadu can steal credentials from Google Chrome.